Avoid Brave-blocked frontend proxy path

[xrpbanks]

Summary

• add /api/calorieapp as a browser-filter-safe alias for the existing same-origin backend proxy
• route frontend readiness, login, callback, account, and food requests through the safe alias
• retain /api/backend unchanged for backward compatibility
• add regression coverage for the direct-origin/same-origin readiness race

Evidence

• the deployed /api/backend/health request is blocked client-side with ERR_BLOCKED_BY_CLIENT, so it never reaches the CalorieApp backend
• the neutral /api/calorieapp/health path is not client-blocked
• all 51 frontend contract tests pass
• frontend lint and production build pass
• local HTTP smoke test confirms both proxy aliases forward to the same upstream /health endpoint

Scope

Frontend route correction only. No WordPress plugin, Xaman payload, login-session contract, layout, footer, or page-content changes.

[Copilot]

🟢 Approval recommended

The routing changes are consistent and covered by updated/new tests, with only minor documentation/test robustness nits noted.

Pull request overview

This PR introduces a browser-filter-safe same-origin proxy alias (/api/calorieapp) and routes frontend readiness/auth/account/food traffic through it to avoid client-side blocking of /api/backend/*, while preserving the legacy /api/backend route for existing clients.

Changes:

• Added a new Next.js API route alias at /api/calorieapp/* that re-exports the existing /api/backend/* proxy handlers.
• Updated frontend request base URLs (readiness + UI flows) from /api/backend to /api/calorieapp.
• Updated and extended test coverage to validate the readiness “direct-origin vs same-origin” race and adjusted existing Xaman-related request assertions.

File summaries

File	Description
tools/tests/xaman_logout_request.test.mjs	Updates logout request expectations to use /api/calorieapp proxy path.
tools/tests/xaman_login_start_retry.test.mjs	Updates identity callback/me/logout/login-status request expectations to /api/calorieapp.
tools/tests/backend_request_route.test.mjs	Adds regression test for readiness race using the new filter-safe same-origin route.
release-check.sh	Adds the new backend route regression test to the release test suite.
README.md	Updates documentation to reference /api/calorieapp as the same-origin proxy path.
frontend/lib/backendRequest.ts	Switches default wake base URL and same-origin readiness probe base to /api/calorieapp.
frontend/components/XamanLoginPanel.tsx	Routes login panel API traffic via /api/calorieapp.
frontend/components/FoodSearchPlaceholder.tsx	Routes food readiness/search related calls via /api/calorieapp.
frontend/components/AccountErasurePanel.tsx	Routes account erasure calls via /api/calorieapp.
frontend/components/AccountDataImportPanel.tsx	Routes account import calls via /api/calorieapp.
frontend/components/AccountDataExportButton.tsx	Routes account export calls via /api/calorieapp.
frontend/app/auth/callback/page.tsx	Routes auth callback flow via /api/calorieapp.
frontend/app/api/calorieapp/[...path]/route.ts	Introduces /api/calorieapp proxy alias by re-exporting legacy backend proxy route handlers.

Review details

• Files reviewed: 13/13 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.